What’s Vulnerable › Vulnerabilities

CVE-2024-11991: Uninitialized memory access in Motoko incremental garbage collector

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-09 · updated 2026-06-17
• Weakness: CWE-908

Description

Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the Canister to enable the incremental garbage collector or enhanced orthogonal persistence, which are non-default features in Motoko.

Affected products

• Internet Computer Motoko: from 0.9.0 before 0.13.4 — fixed in 0.13.4

How to fix

Upgrade to a fixed version: Internet Computer Motoko 0.13.4. Check the vendor advisory for mitigations.

References

• https://github.com/dfinity/motoko/pull/4677
• https://github.com/dfinity/motoko/security/advisories/GHSA-9rhg-3qf8-hrv3

Get alerted when CVE-2024-11991 or the next vulnerability affects your stack